Installing and Using VMware Tanzu CLI v1.3.x

The VMware Tanzu command-line interface (Tanzu CLI) is a command-line tool that connects you to Tanzu. For example, you can use the Tanzu CLI to:

Create and manage management clusters
Create and manage workload clusters
Manage Kubernetes releases
Install and manage packages
Create and manage application workloads
Configure the Tanzu CLI itself

Installing the Tanzu CLI in Internet-Connected Environments

You can install the Tanzu CLI from a binary release or using a package manager such as Homebrew, Chocolatey, APT, YUM, and DNF. To install the Tanzu CLI:

Install the Tanzu CLI
Install Tanzu CLI Plugins

Install the Tanzu CLI

To install the Tanzu CLI, follow the steps below.

Note
If you want to retain an existing installation of the Tanzu CLI, move the CLI binary from /usr/local/bin/tanzu to a different location before following these steps.

Install using a package manager

To install the Tanzu CLI using a package manager:

Follow the instructions for your package manager below. This installs the latest version of the CLI available in the package registry.

APT (Debian or Ubuntu):

sudo apt update
sudo apt install -y ca-certificates curl gpg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://packages-prod.broadcom.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub | sudo gpg --dearmor -o /etc/apt/keyrings/tanzu-archive-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/tanzu-archive-keyring.gpg] https://storage.googleapis.com/tanzu-cli-os-packages/apt tanzu-cli-jessie main" | sudo tee /etc/apt/sources.list.d/tanzu.list
sudo apt update
sudo apt install -y tanzu-cli

To uninstall the CLI:

sudo apt remove tanzu-cli

Chocolatey (Windows):
```
choco install tanzu-cli
```
To uninstall the CLI:
```
choco uninstall tanzu-cli
```
The tanzu-cli package is part of the main Chocolatey Community Repository. When a new tanzu-cli version is released, it may not be available immediately. If the above command fails, run:
```
choco install tanzu-cli --version TANZU-CLI-VERSION
```
Where TANZU-CLI-VERSION is the Tanzu CLI version you want to install.

For example:
```
choco install tanzu-cli --version 1.3.0
```

Homebrew (MacOS):

brew update
brew install vmware-tanzu/tanzu/tanzu-cli

To uninstall the CLI:

brew uninstall tanzu-cli

YUM or DNF (RHEL):

cat << EOF | sudo tee /etc/yum.repos.d/tanzu-cli.repo
[tanzu-cli]
name=Tanzu CLI
baseurl=https://storage.googleapis.com/tanzu-cli-os-packages/rpm/tanzu-cli
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages-prod.broadcom.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub
EOF

sudo yum install -y tanzu-cli # If you are using DNF, run sudo dnf install -y tanzu-cli.

To uninstall the CLI:

sudo yum remove tanzu-cli

Check that the correct version of the CLI is properly installed.
```
tanzu version
version: v1.3.0
...
```
Proceed to Install Tanzu CLI Plugins. If you plan to use Tanzu CLI commands in automation scripts, see Interactive Prompts before installing the plugins.

Install from a binary release

You can download the Tanzu CLI binary from Broadcom Support or GitHub.

To download a binary release of the Tanzu CLI and then install it:

Download the Tanzu CLI binary from Broadcom Support or GitHub:
- From Broadcom Support:
  1. Go to the Tanzu CLI download page on Broadcom Support.
  2. Expand Product Downloads, locate the CLI version that you want to install, and download the Tanzu CLI binary for your operating system (OS).
- From GitHub:
  1. Go to the Tanzu CLI releases page on GitHub.
  2. Locate your desired release version.
  3. From the Assets section of your chosen release, click to download the .tar.gz or .zip file of the Tanzu CLI binary for your OS, for example, tanzu-cli-windows-amd64.zip.
Unpack the Tanzu CLI file for your OS:
- macOS:
```
tar -xvf tanzu-cli-darwin-amd64.tar.gz
```
- Linux:
```
tar -xvf tanzu-cli-linux-amd64.tar.gz
```
- Windows:
  
  Use the Windows extractor tool to unzip tanzu-cli-windows-amd64.zip.
Navigate to the directory containing the extracted CLI binary and then follow the steps below to install the CLI:
- macOS:
  
  Install the binary to /usr/local/bin:
```
install tanzu-cli-darwin_amd64 /usr/local/bin/tanzu
```
- Linux:
  
  Install the binary to /usr/local/bin:
```
sudo install tanzu-cli-linux_amd64 /usr/local/bin/tanzu
```
- Windows:
  1. Create a new Program Files\tanzu folder.
  2. Copy the tanzu-cli-windows_amd64.exe file into the new Program Files\tanzu folder.
  3. Rename tanzu-cli-windows_amd64.exe to tanzu.exe.
  4. Right-click the tanzu folder, select Properties > Security, and make sure that your user account has the Full Control permission.
  5. Use Windows Search to search for env.
  6. Select Edit the system environment variables and click the Environment Variables button.
  7. Select the Path row under System variables, and click Edit.
  8. Click New to add a new row and enter the path to the tanzu CLI. The path value must not include the .exe extension. For example, C:\Program Files\tanzu.
Check that the correct version of the CLI is properly installed.
```
tanzu version
version: v1.3.0
...
```
Proceed to Install Tanzu CLI Plugins if you intend to use the Tanzu CLI in an internet-connected environment or to Download Tanzu CLI Plugins if you intend to use the Tanzu CLI in an internet-restricted environment. If you plan to use Tanzu CLI commands in automation scripts, see Interactive Prompts before installing or downloading the plugins.

Install Tanzu CLI Plugins

A Tanzu CLI plugin is an executable binary that packages a group of CLI commands. The core CLI has some command groups built in, and CLI plugins extend the CLI with additional command groups. For the list of built-in commands, see System Commands.

Specific plugins are relevant to different products and to different contexts that you connect the CLI to, based on the context type. Each product designates its relevant plugins as either standalone or context-scoped, as described in CLI Core, Plugins, Plugin Groups, and Products.

Context-scoped plugins: When you create a Tanzu CLI context to connect to a product, context-scoped plugins install automatically if they are not already installed. As a backup, if plugins do not automatically install, you can install them by running tanzu plugin sync with the CLI set to the desired context.

Standalone plugins: For some but not all products, you need to install standalone plugins by running tanzu plugin install as described below. To find out whether you need to install standalone plugins for your product, see CLI Core, Plugins, Plugin Groups, and Products.

After completing the steps in Install the Tanzu CLI above, follow these instructions to install standalone Tanzu CLI plugins. You can use one command to install all plugins in a plugin group or install each plugin individually.

Install all plugins in a group

To install all plugins in a plugin group:

Choose the plugin group by listing available plugin groups:

tanzu plugin group search

The output lists plugin groups, resembling:

tanzu plugin group search
GROUP                           DESCRIPTION                                           LATEST
vmware-tanzu/app-developer      Plugins for Application Developer for Tanzu Platform  v0.1.1
vmware-tanzu/platform-engineer  Plugins for Platform Engineer for Tanzu Platform      v0.1.1
vmware-tanzucli/essentials      Essential plugins for the Tanzu CLI                   v1.0.0
vmware-tap/default              Plugins for TAP                                       v1.9.1
vmware-tkg/default              Plugins for TKG                                       v2.5.1
vmware-tmc/default              Plugins for TMC                                       v1.0.0
vmware-vsphere/default          Plugins for vSphere                                   v8.0.2

In the output, look for the plugin group for your target, such as vmware-tkg for TKG.
- If you do not want to install the latest version listed, list all available versions for the plugin group:
```
tanzu plugin group search -n PLUGIN-GROUP-NAME --show-details
```
  Where PLUGIN-GROUP-NAME is the group listed in the previous step.
- To see the list of plugins included in the plugin group, run:
```
tanzu plugin group get PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
```
  Where PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION is the plugin group and group version for which you want to list the plugins. If you want to list the plugins for the latest version of the plugin group, you can omit :PLUGIN-GROUP-VERSION when running tanzu plugin group get. For more information about how to list available plugin groups, see tanzu plugin group.
Run one of the following:
- If you want to install all plugins included in the latest version of the plugin group:
```
tanzu plugin install --group PLUGIN-GROUP-NAME
```
  For example:
```
tanzu plugin install --group vmware-tkg/default
```
  The CLI lists the installed version.
- If you want to install all plugins included in a specific version of the plugin group:
```
tanzu plugin install --group PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
```
  Where PLUGIN-GROUP-VERSION is the desired version as listed with --show-details in the previous step. For example:
```
tanzu plugin install --group vmware-tkg/default:v2.3.0
```
Verify that the plugins installed successfully by running:
```
tanzu plugin group get PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION
tanzu plugin list
```
Where PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION is the plugin group and group version from which you installed the plugins. If you installed the plugins from the latest version of the plugin group, you can omit :PLUGIN-GROUP-VERSION when running tanzu plugin group get. Each plugin name and plugin version returned by tanzu plugin group get must be included in the output of tanzu plugin list.

Install a single plugin

To install a single plugin:

Choose the plugin you want to install:

tanzu plugin search

The output lists plugins, resembling:

tanzu plugin search
NAME                DESCRIPTION                                                    TARGET      LATEST
cluster             Kubernetes cluster operations                                  kubernetes  v0.29.0
feature             Operate on features and featuregates                           kubernetes  v0.29.0
kubernetes-release  Kubernetes release operations                                  kubernetes  v0.29.0

If you want to list all available versions for the plugin, run:

tanzu plugin search -n PLUGIN-NAME --show-details

Where PLUGIN-NAME is the plugin you chose above. For more information about this command and its options, see tanzu plugin search.

Run one of the following:
- If you want to install the latest version of the plugin:
```
tanzu plugin install PLUGIN-NAME
```
- If you want to install a specific version of the plugin:
```
tanzu plugin install PLUGIN-NAME --version PLUGIN-VERSION
```
If a plugin with the same name exists for more than one target, you must specify the --target flag when installing the plugin. For example, for the target k8s:
```
tanzu plugin install PLUGIN-NAME --target k8s
```
For more information about tanzu plugin install and its options, see tanzu plugin install.
Verify that the plugin installed successfully by running:
```
tanzu plugin list
```

Installing the Tanzu CLI in Internet-Restricted Environments

You can install and use the Tanzu CLI in an internet-restricted environment, which includes the following steps:

Download and Install the Tanzu CLI Binary
Download Tanzu CLI Plugins
Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment

Download and Install the Tanzu CLI Binary

To download and install the Tanzu CLI binary:

While connected to the internet, download the Tanzu CLI binary to a storage device, such as your computer, and then install it. To download and install the Tanzu CLI binary, follow the instructions in the Install from a binary release tab in Install the Tanzu CLI above.
Proceed to Download Tanzu CLI Plugins below.

Download Tanzu CLI Plugins

The Tanzu CLI allows you to install and run CLI plugins in internet-restricted environments with no physical connection to the internet. For information about Tanzu CLI plugins, see Install Tanzu CLI Plugins above.

To enable the Tanzu CLI to install and update plugins in an internet-restricted environment, you must set up a private Docker-compatible container registry such as Harbor, Docker, or Artifactory.

Note: The Tanzu CLI supports uploading plugins to private registries that require authentication. However, your private registry must allow the CLI to pull the resulting images without authentication.

After the private registry is set up, the operator of the private registry can download the Tanzu CLI plugins required from the publicly available registry and move them to the private registry as follows:

Using the computer with the Tanzu CLI installed, download the desired CLI plugins as a tar.gz file to your storage device.

To discover which plugin groups and plugins are available for download, use the tanzu plugin group search and tanzu plugin search commands. For information about using these commands, see tanzu plugin. After you identify the desired CLI plugins, you can use any of the options below to download them:
- Download all plugins available in the default central repository:
```
tanzu plugin download-bundle --to-tar /tmp/FILE-NAME.tar.gz
```
- Download all plugins included in the latest version of a specific plugin group. The command below uses the vmware-tkg/default plugin group as an example:
```
tanzu plugin download-bundle --group vmware-tkg/default --to-tar /tmp/FILE-NAME.tar.gz
```
- Download all plugins included in a specific version of a plugin group, for example, v2.3.0 of vmware-tkg/default:
```
tanzu plugin download-bundle --group vmware-tkg/default:v2.3.0 --to-tar /tmp/FILE-NAME.tar.gz
```
  You can also specify more than one plugin group version. For example:
```
tanzu plugin download-bundle --group vmware-tkg/default:v2.3.0,vmware-tkg/default:v2.2.0 --to-tar /tmp/FILE-NAME.tar.gz
```
  For more information about tanzu plugin download-bundle and its options, see tanzu plugin download-bundle.
Proceed to Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment below.

Move the Tanzu CLI and CLI Plugins to Your Internet-Restricted Environment

To configure the Tanzu CLI in your internet-restricted environment:

Move the storage device and if separate, the computer with the Tanzu CLI installed to your internet-restricted environment.
If the private registry requires authentication to upload images, run docker login or crane auth login to set up authentication with the registry.
If the private registry is configured with a self-signed CA certificate, add your certificate verification preferences by following the instructions in Adding Certificate Configuration for the Custom Registry below.
Upload the CLI plugins to the registry in the internet-restricted environment using the tanzu plugin upload-bundle command. For example:
```
tanzu plugin upload-bundle --tar /tmp/FILE-NAME.tar.gz --to-repo registry.example.com/tanzu_cli/plugins
```
The tanzu plugin upload-bundle command uploads the plugin bundle to the specified private repository and publishes the plugin inventory image under plugin-inventory:latest. In the example above, the plugin inventory image will be published to registry.example.com/tanzu_cli/plugins/plugin-inventory:latest. If you already uploaded any plugins to the specified private repository, the command will keep them and append your new plugins from the plugin bundle to the existing ones.
Update the Tanzu CLI to point to the new plugin source:
```
tanzu plugin source update default --uri registry.example.com/tanzu_cli/plugins/plugin-inventory:latest
```
Note: Each Tanzu CLI user working within your organization will need to execute the tanzu plugin source update command above in order to access and install or update the plugins that you make available in your internal registry.
Verify that the plugins are discoverable by running the tanzu plugin search and tanzu plugin group search commands.
Remove all pre-existing plugins before the final validation step:
```
tanzu plugin clean && tanzu plugin list
```
Run tanzu plugin install --group PLUGIN-GROUP-NAME:PLUGIN-GROUP-VERSION to test plugin installation from your new plugin source.
Run tanzu plugin list to confirm the expected plugins have been installed.

Adding Certificate Configuration for the Custom Registry

If your custom registry is configured with a self-signed CA certificate, you must do one of the following:

Provide the registry CA certificate to the Tanzu CLI
Configure the Tanzu CLI to use HTTPS connections and skip server certificate verification by activating the skip-cert-verify option
Allow HTTP connections to the registry and skip server certificate verification by activating the --insecure option

If your registry CA certificate is expired, use the --skip-cert-verify or --insecure option.

To configure your certificate verification preferences for the registry CA certificate:

To add the registry CA certificate to the Tanzu CLI, run the tanzu config cert add command with the --ca-certificate option. For example:
```
tanzu config cert add --host test.registry.com --ca-certificate PATH-TO-CA-CERT
```
If the registry is serving on a non-default port, add the port number. For example:
```
tanzu config cert add --host test.registry.com:8443 --ca-certificate PATH-TO-CA-CERT
```
To skip certificate verification, run the tanzu config cert add command with the skip-cert-verify option. For example:
```
tanzu config cert add --host test.registry.com --skip-cert-verify true
```
To allow HTTP connections to the registry and skip certificate verification, run the tanzu config cert add command with the --insecure option. For example:
```
tanzu config cert add --host test.registry.com  --insecure true
```

You can update or delete your certificate configuration using the tanzu config cert update and tanzu config cert delete commands. For more information, see tanzu config cert.

Adding a Proxy CA certificate

If you configured a proxy between the Tanzu CLI and the central repository and the proxy uses a self-signed CA certificate, set the PROXY_CA_CERT environment variable to the Base64 value of the proxy CA certificate.

Updating the Tanzu CLI

To update your Tanzu CLI version, follow the instructions below.

Note
If you want to retain an existing installation of the Tanzu CLI, move the CLI binary from /usr/local/bin/tanzu to a different location before following the instructions below.

Update using a package manager

To update the Tanzu CLI version using a package manager:

Follow the instructions for your package manager below. This updates the CLI to the latest available version.
- APT (Debian or Ubuntu):
```
sudo apt update
sudo apt upgrade -y tanzu-cli
```
- Chocolatey (Windows):
```
choco install tanzu-cli
```
  The tanzu-cli package is part of the main Chocolatey Community Repository. When a new tanzu-cli version is released, it may not be available immediately. If the above command fails, run:
```
choco install tanzu-cli --version TANZU-CLI-VERSION
```
  Where TANZU-CLI-VERSION is the version you want to update the CLI to.
  
  For example:
```
choco install tanzu-cli --version 1.3.0
```
- Homebrew (MacOS):
```
brew update
brew upgrade tanzu-cli
```
- YUM or DNF (RHEL):
```
sudo yum update -y tanzu-cli # If you are using DNF, run sudo dnf update -y tanzu-cli.
```
Check that the correct version of the CLI is properly installed.
```
tanzu version
version: v1.3.0
...
```

Update using a binary release

To update the Tanzu CLI version using a binary release:

If you are updating the CLI version in an internet-connected environment, follow the instructions in Installing the Tanzu CLI in Internet-Connected Environments above.
If you are updating the CLI version in an internet-restricted environment, follow the instructions in Installing the Tanzu CLI in Internet-Restricted Environments above.

Interactive Prompts

When you run any Tanzu CLI command, except tanzu version, tanzu config set, and tanzu config eula, for the first time, the Tanzu CLI prompts you to accept the VMware General Terms and configure the status of VMware’s Customer Experience Improvement Program (CEIP). If you plan to use Tanzu CLI commands non-interactively, for example, in automation scripts, ensure that you accept the VMware General Terms and configure your CEIP status before executing Tanzu CLI commands in your scripts.

To accept the VMware General Terms, you can use the tanzu config eula show and tanzu config eula accept commands. For more information about these commands, see tanzu config eula in Tanzu CLI Command Reference.
To configure CEIP, you can set the TANZU_CLI_CEIP_OPT_IN_PROMPT_ANSWER environment variable to Yes or No or use the tanzu telemetry cli-usage-analytics update command. For more information about tanzu telemetry cli-usage-analytics update, see tanzu telemetry cli-usage-analytics in Tanzu CLI Command Reference.

Previous Versions

Previous versions of the Tanzu CLI were bundled with product downloads for Tanzu Kubernetes Grid (TKG) and Tanzu Application Platform (TAP), and the installation of the CLI was different depending on which product you were using. For more information about Tanzu CLI releases prior to v0.90.0, see Compatibility with VMware Tanzu Products.

For information about the current Tanzu CLI support policy, see Tanzu CLI Policy on GitHub.

What to Do Next

For more information, see: